Who is ultimately responsible for ensuring that information is categorized and that protective measures are
taken?

A.
Information security officer

B.
Security steering committee

C.
Data owner

D.
Data custodian

Explanation:

Routine administration of all aspects of security is delegated, but senior management must retain overall responsibility. The information security officer supports and implements information security for senior management. The data owner is responsible for categorizing data security requirements. The data custodian supports and implements information security as directed.